File CVE-2018-14644-rec-4.1.4.patch of Package pdns-recursor

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2018-14644-rec-4.1.4.patch of Package pdns-recursor

Index: pdns-recursor-4.1.2/syncres.cc
===================================================================
--- pdns-recursor-4.1.2.orig/syncres.cc
+++ pdns-recursor-4.1.2/syncres.cc
@@ -116,6 +116,8 @@ SyncRes::SyncRes(const struct timeval& n
 /** everything begins here - this is the entry point just after receiving a packet */
 int SyncRes::beginResolve(const DNSName &qname, const QType &qtype, uint16_t qclass, vector<DNSRecord>&ret)
 {
+  /* rfc6895 section 3.1 + RRSIG and NSEC3 */
+  static const std::set<uint16_t> metaTypes = { QType::AXFR, QType::IXFR, QType::RRSIG, QType::NSEC3, QType::OPT, QType::TSIG, QType::TKEY, QType::MAILA, QType::MAILB };
   vState state = Indeterminate;
   s_queries++;
   d_wasVariable=false;
@@ -126,8 +128,9 @@ int SyncRes::beginResolve(const DNSName
     return 0;
   }
 
-  if( (qtype.getCode() == QType::AXFR) || (qtype.getCode() == QType::IXFR) || (qtype.getCode() == QType::RRSIG) || (qtype.getCode() == QType::NSEC3))
+  if (metaTypes.count(qtype.getCode())) {
     return -1;
+  }
 
   if(qclass==QClass::ANY)
     qclass=QClass::IN;
@@ -472,7 +475,7 @@ int SyncRes::asyncresolveWrapper(const C
       return ret;
     }
     else if(mode==EDNSStatus::UNKNOWN || mode==EDNSStatus::EDNSOK || mode == EDNSStatus::EDNSIGNORANT ) {
-      if(res->d_rcode == RCode::FormErr || res->d_rcode == RCode::NotImp)  {
+      if(!res->d_haveEDNS && (res->d_rcode == RCode::FormErr || res->d_rcode == RCode::NotImp)) {
 	//	cerr<<"Downgrading to NOEDNS because of "<<RCode::to_s(res->d_rcode)<<" for query to "<<ip.toString()<<" for '"<<domain<<"'"<<endl;
         mode = EDNSStatus::NOEDNS;
         continue;

Places

File CVE-2018-14644-rec-4.1.4.patch of Package pdns-recursor

Places